{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-93483 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-93483 is a critical authentication bypass vulnerability in Znuny, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-93483 and fix it if it is affected.\n\nWhat it is: CVE-2026-93483 is a critical authentication bypass vulnerability in Znuny, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-93483 in the wild and no public exploit code.\n\nAffected product: Znuny. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-93483/ (Markdown: https://insights.sbomify.com/CVE-2026-93483/index.md)","id":"CVE-2026-93483","markdown":"https://insights.sbomify.com/CVE-2026-93483/index.md","name":"CVE-2026-93483","record":{"aliases":["DEBIAN-CVE-2026-93483","GHSA-g4fx-r8m5-c6r7","UBUNTU-CVE-2026-93483"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["privilege_escalation","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Znuny ticketing system","requires_auth":"none","summary":"Attackers can bypass authentication and impersonate any user, including admins, by forging the Remote-User header in Znuny systems using HTTPBasicAuth.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":9.5,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/AU:Y/R:U/RE:L/U:Red","version":"4.0"},"cwes":[{"id":"CWE-348","name":"Use of Less Trusted Source"}],"description":"In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable \"Remote-User\" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Auth bypass in Znuny","id":"CVE-2026-93483","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"SQL injection in Znuny","id":"CVE-2026-93484"},"packages":[],"prev":{"headline":"NGINX map directive and regex matching vulnerability","id":"CVE-2026-93479"},"products":["Znuny"],"published":"2026-10-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Znuny"]},"summary":"Attackers can bypass authentication and impersonate any user, including admins, by forging the Remote-User header in Znuny systems using HTTPBasicAuth.","url":"https://insights.sbomify.com/CVE-2026-93483/"}